CVE-2026-59870 PUBLISHED

js-yaml quadratic-complexity denial of service via YAML11_SCHEMA !!omap parsing

Assigner: GitHub_M
Reserved: 07.07.2026 Published: 08.07.2026 Updated: 08.07.2026

js-yaml is a JavaScript YAML parser and dumper. From 5.0.0 before 5.2.1, YAML11_SCHEMA support for the !!omap tag in src/tag/sequence/omap.ts uses omapTag.addItem() to perform a linear duplicate-key scan on every insertion, causing O(n^2) CPU consumption when yaml.load() parses a crafted ordered-map document. This issue is fixed in version 5.2.1.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS Score: 5.3

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	Low

CVSS 3.1

Product Status

Vendor	nodeca
Product	js-yaml
Versions	Version >= 5.0.0, < 5.2.1 is affected

References

https://github.com/nodeca/js-yaml/security/advisories/GHSA-724g-mxrg-4qvm
https://github.com/nodeca/js-yaml/commit/39f3211a2f01b3c6982710cf21434ab7060acefe
https://github.com/nodeca/js-yaml/releases/tag/5.2.1

Problem Types

CWE-407: Inefficient Algorithmic Complexity CWE